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Spacecraft parachute recovery systems, especially those with a parachute cluster, require testing to identify 
and reduce failures. This is especially important when the spacecraft in question is human-rated. Due to the recent 
effort to make spaceflight affordable, the importance of determining a minimum requirement for testing has 
increased. The number of tests required to achieve a mature design, with a relatively constant failure rate, can be 
estimated from a review of previous complex spacecraft recovery systems. Examination of the Apollo parachute 
testing and the Shuttle Solid Rocket Booster recovery chute system operation will clarify at which point in those 
programs the system reached maturity. This examination will also clarify the risks inherent in not performing a 
sufficient number of tests prior to operation with humans on-board. 


When looking at complex parachute systems used in spaceflight landing systems, a pattern begins to 
emerge regarding the need for a minimum amount of testing required to wring out the failure modes and reduce the 
failure rate of the parachute system to an acceptable level for human spaceflight. Not only a sufficient number of 
system level testing, but also the ability to update the design as failure modes are found is required to drive the 
failure rate of the system down to an acceptable level. In addition, sufficient data and images are necessary to 
identify incipient failure modes or to identify failure causes when a system failure occurs. In order to demonstrate 
the need for sufficient system level testing prior to an acceptable failure rate, the Apollo Earth Landing System 
(ELS) test program and the Shuttle Solid Rocket Booster Recovery System failure history will be examined, as well 
as some experiences in the Orion Capsule Parachute Assembly System will be noted. 

I. Apollo 

The Apollo Earth Landing System is the first parachute system being examined to consider the test 
program and implications to system reliability. The Apollo ELS consisted of two mortar-deployed parachutes and 
thre mortar deployed pilots which deployed the three main parachutes. The Apollo program actually ended up 
qualifying three landing system design iterations: Block I, Block II, and Block II Heavy designs all ended up being 
human-rated and had the test programs considered adequate to human rate those landing systems, even though only 
the Block II Heavy ELS ended up as a manned vehicle . Also of note is the fact that the Apollo program built on the 
experience of both the Mercury and Gemini programs. In the case of the Mercury program, 152 tests were 
performed and in the case of the Gemini program, 67 tests were performed, yet the Apollo program still ended up 
performing 147 tests before humans flew on the vehicle, and that isn’t even taking into account the unmanned 
vehicle tests. Admittedly, a significant portion of that testing was needed due to the shift to a cluster of parachutes in 
the case of the drogue and the main chutes. 

The Apollo ELS test program 1 consisted of three different test vehicles, a bomb for individual canopy test; 
a PTV, or dart, which had a flight-like crew module parachute compartment and vehicle mass, but not wake or 
vehicle dynamics; and a boilerplate which had both a flight-like parachute compartment, mass, wake and vehicle 
dynamics. Figure 1 shows the boilerplate in descent. The Apollo program took film of each test to be examined 
after the test, as well as recovering the parachutes for examination after testing. Also as noted below, when failures 
occurred, updates to the design of the system or to the parachutes were made to prevent those failures from 
reoccurring. 
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Figure 1 



In the case of the Block I design, 105 drop tests were performed, with 26 of those being system level tests. 1 
During the Block I fifth system level test, the riser harness legs were severed causing the main parachutes to detach 
and loss of the test vehicle. This occurred after four successful system level tests with the same harness design. It 
points out that a certain number of system level tests are needed for some failure modes to occur and be identified. 
Also of note is the fact that the Apollo design was changed after this failure to eliminate the possibility of this failure 
mode. In addition, even after the development testing was complete, 20 significant anomalies occurred during Block 
I qualification testing. 

In the case of the Block II design, only 15 tests were performed. During development testing, on the 
second drop test, a complete gore was split from the skirt band to the vent band of the main parachute while inflating 
from disreef to full open. 1 The main parachute had previously seen higher loads following disreef, but this test 
produced much higher local stress levels in the canopy skirt than on previous tests during Block I. This clearly 
shows the need to test over the range of possible operating conditions. The main chute design was changed to 
include reinforcing tapes to strengthen the canopy. 

In the case of the Block II Heavy ELS, 32 tests were performed, with 1 1 of those being system level tests. 
So for the Apollo program to get to the vehicle that actually flew humans, there were 147 total tests, with 51 of those 
being system level tests. While acknowledging the fact that some of that amount of testing was due to the changes 
in the vehicle from Block I to Block II and finally Block II heavy, it should be noted that even during Block II 
qualification testing, anomalies were noted in the ELS. 
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II. Space Shuttle SRB 

Although the Space Shuttle SRB recovery parachutes were not human -rated, the operational history of the 
SRB recovery chutes is well-documented, and since the chutes were recovered failure modes were identifiable. In 
addition, the SRB chute system design was updated to respond to the failures identified during operation. This 
makes the SRB recovery chutes an ideal system to examine the change in failure rate at the beginning of the 
operational life of the system, and to draw some conclusions about what that means in regards to an adequate 
number of system tests prior to human rating a similarly complex parachute landing system. Concentrating on the 
SRB recovery Large Main Chutes (LMP) gives sufficient data to do a regression analysis. 

The Shuttle SRB consisted of one pilot, one drogue, and three mains used to slow the SRB for a survivable 
water impact. Approximately four minutes after the SRB separation, the SRB nose cap is jettisoned, deploying the 
pilot parachute, which then deploys the drogue. At frustum separation, the drogues pull the frustum away from the 
SRB, deploying the main parachutes stowed in the frustum. All three main parachutes are required to inflate to 
provide sufficient drag to slow the SRB down enough to survive the water impact with no damage. Figure 3 shows 
the SRB under drogues and mains. The SRB, drogues, frustum, and main chutes are all retrieved. The drogue and 
main chutes are cleaned, inspected, and repaired as needed. This is a key part of using the SRB LMPs as a study, as 
retrieval and inspection allow for investigation into causes of failures that would not be as thorough with video data 
alone. 



Figure 3 


Several design changes were made to the SRB Recovery system. One of the more notable design changes 
was the replacement of the 115 ft main chutes with the LMP chutes. Discussion is limited to the LMPs, as the 
failure rate data for the LMPs is a larger data set. The data for 23 Shuttle missions is considered. In addition to the 
design change shifting to larger mains, several changes were made to improve reliability of the LMPs by removing 
failure mechanisms where possible, and by improving inflation and deployment characteristics of the main chutes. 
These changes included improved bi-pod strut close-out in the frustrum, incorporating rip stops, incorporating main 
packing modifications and vent line stacking modifications, among others. Only main chute failures that resulted in 
water impact above the allowed descent rate are counted when discussing failure rate, although partial failures were 
also tracked by the Shuttle program.. From STS-41G through STS- 124, 7 LMP failures, and 22 examples of notable 
damage occurred. Figure 4 tracks where in the operational life the failures occurred. Please note that the end of the 
Shuttle program is not being addressed, as some differences in use of the parachutes were present at that time. 
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Even from Figure 4, with no analysis, it is apparent that the failures cluster at the beginning of the 
operational life of the LMPS. Without the changes in design to address observed failures, the improvement in the 
failure rate of the LMPs would not have occurred. A regression analysis 3 , using logistic regressions, shows that 
reliability growth is present in the system. The graph in Figure 5 shows the probability of SRB FMP failure per 
mission. It is significant to note that it takes between 12 -14 missions before the curve starts to flatten out. 
Considering there are two SRBs per Shuttle mission, that equivalent to between 24-28 system level demands on the 
FMPs. 
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The SRB LMPs failures were investigated for root cause in each case. Where notable damage occurred, 
determinations of causes were made if possible. This was possible partially due to the fact that the LMPs were 
recovered after each use, and examined for damage. 

III. CPAS 

CPAS consists of two mortar deployed drogues and three mortar deployed pilots which deploy the three 
mains. It is therefore of similar complexity to the Apollo ELS. CPAS intends to perform 26 system level tests, split 
between development tests and qualification tests. For these tests CPAS will be using two different test techniques 
for systems tests, one with a flight-like test vehicle for testing in the wake, and one with a dart vehicle for higher 



Figure 6 


During the first eight system level development tests, several potential failure modes have been identified. 
Of the failures identified, most notable are the failure of the reefing line cutter due to off-angle loads, damage of the 
suspension lines, potential failure of the transition links from steel to textile risers, reefing ring attachment failure, 
damage to reefing rings, and a potential failure of the main retention system. The CPAS design has been changed in 
each case to eliminate the failure mode and improve the reliability of the system. The damage to the suspension 
lines was eliminated by a change to the packing process. The failure of the reefing cutters was addressed by adding 
a feature to ensure that the cutters are activated within their allowable pull angle. The transition from steel riser to 
textile was redesigned to prevent two concentrated masses contacting each other. The reefing ring attachment was 
redesigned to have greater strength, and CPAS is attempting to shift to textile reefing loops to prevent a cracked 
metallic reefing ring from resulting in a skipped stage. In addition, the CPAS project has been diligent in taking as 
much data as possible during the tests, performing a thorough examination of the chutes post-test, and tracking 
anomalous events with examination of failure causes. 

IV. Recommendations 

From the example of the SRB LMPs, it is apparent that a certain number of tests are necessary to drive the 
failure rate of a complex parachute system down to an acceptable rate. For as system as complex as those discussed, 
over twenty-five system level tests are needed to achieve the potential reliability of the system. This is only 
possible, however, if data including damage mapping of the chutes is obtained from the tests and if the design is 
changed to eliminate the failure modes seen during testing. Without updating design, no change in failure rate is 
going to be achievable. It is recommended for those parachute systems of similar complexity to the Apollo ELS that 
will be used for human flight to perform enough system level tests to drive the failure rate down during development 
testing so that design updates can be incorporated to achieve the most reliable parachute system possible. To aid in 
eliminating failure modes seen during testing, as much data as possible should be collected, including as many 
different video images and views of the parachutes as possible, including views of the deploying parachutes. In 
addition, all anomalous events during testing, as well as any damage to the parachutes, should be tracked and root 
causes found so that the parachute system design can be changed to prevent those failure modes. 
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